Last Updated: October 1, 2026 · Operated by BOMAD LLC · www.moqa.me · support@moqa.me

The Short Version

MOQA exists to give you back control of your attention. That only works if you can trust us with the data that makes MOQA work — so here's the deal, up front. If anything below conflicts with this summary, the detailed sections control.

• Apple's Screen Time records stay on your device — always. Apple's framework keeps your detailed usage records on your phone, and it does not let MOQA read them. The only screen-time-related information you can send us, through Bank It, is an encrypted summary of MOQA's own derived MQ Score components and challenge validations, computed on your device.

• We never use your MQ, Bank It, or health-derived data for marketing or advertising, and we never sell it. Not to anyone, not for anything. The derived MQ summary and any health-based components you choose to send us do one job — running MOQA: your MQ Score, your Beans, your Bags — and nothing else. (If you opt in to tips and product emails, we use your email address for that and you can stop them anytime.)

• You're the customer, not the product. MOQA makes money from subscriptions, not ads. We do not sell your personal information, we do not share it for targeted advertising, and we do not run ads in MOQA. We never show you Apple's tracking prompt and never use the advertising identifier.

• Our partners work for us, not on you. We use a small set of service providers — like Amazon Web Services for hosting, RevenueCat for subscription infrastructure, AppsFlyer for install attribution, Firebase Crashlytics for crash reporting, OneSignal for push notifications, Brevo for email, and Tremendous for issuing Reward gift cards — under contracts that limit them to working on our behalf. Our hosting provider stores your encrypted Bank It data solely on our behalf, and no attribution, analytics, or advertising provider ever receives your Bank It data, your MQ Score, or any Screen Time- or health-derived information. Our rewards partner receives only the email address needed to deliver your Reward (a parent's, for users under 18), the Reward value, and the brand you chose — never your MQ Score, your Spin challenge results, or any usage data.

• You're in control. You can revoke permissions in your device settings, opt out of marketing anytime, and delete your data from inside the app.

• MOQA is 13+. We do not knowingly collect personal information from children under 13 (or under a higher minimum age where your region requires one).

1. Who We Are & What This Policy Covers

MOQA is a digital-wellbeing app operated by BOMAD LLC ("MOQA," "we," "us," or "our"), 1107 Fair Oaks Avenue, #226, South Pasadena, CA 91030. This Privacy Policy explains what personal information we collect, how we use and share it, and the choices and rights you have. It covers the MOQA app, our website at www.moqa.me, and related services (the "Service"), and it is part of our Terms of Use.

BOMAD LLC is the controller of the personal information described in this Policy. This Policy describes how we handle personal information when you use the Service; where the law requires your consent for a particular use of your information, we ask for it separately. If these practices aren't acceptable to you, please don't use the Service.

​

2. Our Principles

Everything we build follows three principles:

• Privacy first — you control your data. Sensitive data stays on your device by default, and sharing it with us is always your affirmative choice.

• Transparency — we explain how and why we use your information, in plain language, before we use it.

• Mindful design — we collect the minimum information needed to run MOQA and make it better. If we don't need it, we don't collect it; if we don't collect it, nobody can misuse it.

3. Information We Collect

3.1 Information you give us

Account information. When you create a MOQA account, we collect the information needed to set it up and run it — such as your email address, a username (which serves as your display name), your birth month and year, which we use to apply our age requirements, and the two-letter country code your device is set to. We don't collect your exact date of birth, and you choose your username — it doesn't have to be your real name.

Sign in with Apple. If you sign in with Apple, Apple gives us a unique Apple user ID and your email address — or, if you choose Hide My Email, an Apple private-relay address that forwards to you — and, if you share it, your first and last name. Apple's own terms govern that sign-in.

Profile and content. Information you add to your profile, your Buddy and customization choices, and the Circles you create or join, including a Circle's name and its members. Circles have no chat, feed, or messaging, so there are no messages for us to collect.

Onboarding estimates. During setup we ask you to estimate your typical screen, movement, and offline time. We store these self-reported estimates as a starting point so we can show you how you've changed over time. They are your own guesses, not measurements, and they don't come from Apple's Screen Time or HealthKit.

Communications. When you contact us at support@moqa.me, respond to a survey, or send us feedback or a report through the app, we collect the contents of that communication and the contact details you provide.

Reward delivery information. If you redeem a Bag for a Reward, we use the Reward participant's email address — yours, or a parent or guardian's if you are under 18 — and the brand you chose to deliver a digital gift card or process a charity donation, and if you redeem for merchandise, we collect the shipping information needed to send it to you.

Referrals. Invitations to friends are sent by you, from your own device, using your own messaging apps. We do not access, upload, or store your contacts, and we do not collect or store an invited person's contact information unless and until they choose to engage with MOQA.

Parental consent (under 16). If your birth month and year indicate you are under 16, we collect a parent or guardian's email address for one purpose only: obtaining their consent before your account activates (see Section 9). We use that email address solely to run the consent process and send any legally required notices, and if consent is not completed within 30 days, we delete the parent's email address, the registration information provided, and any other personal information collected during signup.

​

3.2 Screen Time, Health Data & Bank It

This is the most sensitive data MOQA touches, so here's exactly how it works. MOQA is built on Apple's Screen Time / Device Activity framework. Apple's framework keeps your detailed usage records on your device and does not allow MOQA to read them directly. MOQA can display your information and your MQ Score on your device, but those records are not released to us.

We never receive your underlying Screen Time records — not app names, not per-app usage, not browsing activity, not raw usage logs. What you can choose to share through Bank It is a limited summary calculated on your device: MOQA's proprietary MQ Score components — one derived score per pillar, each built on your device from several inputs combined by MOQA's proprietary algorithm — together with validation of your challenges, streaks, and similar events. Screen MQ blends your screen time and pickups. Move MQ blends your step activity and workout time. Offline MQ blends your overnight screen time and pickups (currently 10 pm to 6 am), your Unplug and Brick Mode time, and your mindful minutes. The inputs are weighted and merged before anything leaves your device, and the summary is designed so that the underlying inputs — your screen time, pickups, app usage, steps, workouts, or mindful minutes — cannot be recovered from the scores. We receive the scores and the validations; we never receive the inputs, which stay on your device inside Apple's Screen Time and HealthKit frameworks. The scores are Screen Time- and health-derived and directionally reflect your habits, which is why we treat them as sensitive, but they are not your usage records: exact minutes, pickup counts, and app-level detail are never sent to us.

To submit, you take a screenshot of a MOQA QR code that encodes this summary and share it with us through the system photo picker, which gives MOQA access only to the image you select — never your photo library. We decode the QR payload from the image, delete the image promptly, and retain only the decoded verification summary. Deleting our copy doesn't touch the screenshot in your own Photos library or backups — that copy is yours to keep or delete. The QR payload is encrypted using measures designed to prevent anyone without MOQA's decryption capability from reading it — even if the screenshot is seen or shared. Submitting it is an affirmative, voluntary act of sharing that data with us.

We use your Bank It data to verify the activities tied to your Beans, Bags, and Rewards; to give you accurate feedback about your MQ Score — including your Screen, Move, and Offline MQ — over time (never about your underlying screen time, pickups, or health records, which we don't have); to calculate and persist your MQ Score and statistics over time; to show you where your MQ Score ranks against other MOQA users (shown only to you — your name is never shown to anyone outside your Circles) and to compile your Circle results; and to operate related features. We use the minimum information necessary for these purposes. We do not use it for marketing or advertising, we do not sell it, and we do not disclose it to third parties for their own purposes — it is shared only with service providers hosting and processing it on our behalf under contractual protections (see Section 5), or where required by law.

​

3.3 Health data (HealthKit)

With your separate, optional permission, MOQA may read HealthKit data — steps, workouts, and mindful minutes — to enrich your MQ Score. Like your Screen Time records, HealthKit data is read and processed on your device: we do not receive your underlying HealthKit records, only the derived MQ components you choose to submit through Bank It (see Section 3.2). You can grant or revoke this permission at any time in your device settings. We use HealthKit data only to provide MOQA's features. We do not use HealthKit data for advertising, marketing, or other use-based data mining purposes unrelated to your health and wellbeing, and we never sell or disclose it to advertising platforms, data brokers, or information resellers.

3.4 Information collected automatically

Device and diagnostic information. Device model, operating system version, app version, language, time zone, unique app-level identifiers, IP address, crash logs, and performance data. This is standard for any app that connects to a server and is used to run, secure, and debug the Service.

Usage information. How you use MOQA — features used, actions taken, and the time and frequency of your activity — so we can understand what helps people and improve the Service. This is MOQA app usage, not your usage of other apps: your Screen Time data is handled exclusively as described in Section 3.2.

Buddy. Your Buddy's messages are written by us and delivered by the app. No AI service or outside provider reads your MQ Score, your activity, or anything else about you to generate them.

Approximate location. We don't determine your location ourselves — not from GPS, and not from your IP address. Our install-attribution provider infers a country or region from IP to tell us which campaign an install came from (see Section 5), and that is the only location-level information we receive about app users.

Subscription and purchase information. When you subscribe or make a purchase, Apple processes the payment. We never receive or store your payment card details. We receive transaction records — such as your plan, purchase and renewal status, and tokenized receipt data — through Apple and our subscription infrastructure provider so we can unlock what you've paid for.

Install attribution. When you first install MOQA, we use a mobile measurement provider to understand which marketing campaign, if any, led to the install, so we know whether our marketing spend is working. This uses device-level technical data as described in Section 5. MOQA does not use Apple's advertising identifier (IDFA) and never shows you Apple's App Tracking Transparency prompt; our attribution provider is configured to work without it. For users under 16, once we learn your age we switch on our attribution provider's anonymization setting, so your app-usage events are no longer linked to your device identifier. You never need to enable advertising tracking to use MOQA or to earn any Bean, Bag, or Reward.

When you first open MOQA. A few of our service providers — for attribution, subscriptions, push notifications, and crash reporting — register your device the first time you open the app, before you tell us your age: an anonymous app-level identifier, device model, iOS version, and IP address. None of them receive your name, email address, or birth month and year until after the age screen, and none receive the advertising identifier at any point.

4. How We Use Information

• Service delivery: to provide, operate, maintain, and secure MOQA; create and authenticate your account; calculate and persist your MQ Score; operate Beans, Bags, Rewards, Circles, Unplug, Brick Mode, and Buddy features; verify activity through Bank It; compile weekly rankings; and deliver Rewards you redeem.

• Service improvement: to understand how MOQA is used, test and improve features, fix bugs, and create new features — including by creating and analyzing de-identified and aggregated information that no longer identifies you.

• Communications: to send service and account messages (which you can't opt out of while you have an account), deliver earned Rewards, respond to you, and — only with your consent — send tips, product updates, and marketing you can unsubscribe from at any time.

• Fairness and fraud prevention: to verify honest participation, detect and prevent manipulation of the MQ Score, Beans, the Spin, Bags, or Rewards, and enforce our Terms of Use.

• Compliance and protection: to comply with applicable law and legal process, and to protect the rights, safety, and property of you, us, and others.

We do not use your personal information for automated decisions that produce legal or similarly significant effects about you, and we do not sell it or use it to serve you third-party advertising.

​

5. How We Share Information

We do not sell your personal information, and we do not share it with third parties for cross-context behavioral advertising. We share personal information only as described below, and our service providers are bound by contracts that limit them to processing on our behalf and prohibit them from using your information for their own purposes. The specific providers we name below may change as MOQA grows; any replacement or additional provider is bound by the same contractual limits.

Service providers. Companies that currently help us run MOQA:

• Amazon Web Services (AWS) — cloud hosting and storage. Your data, including encrypted Bank It data, is stored on AWS infrastructure on our behalf, encrypted in transit and at rest.

• RevenueCat — subscription infrastructure. Receives app-level identifiers and Apple transaction receipt data to manage your subscription status. Never receives your payment card details (we never have them) or any Screen Time- or health-derived information.

• AppsFlyer — mobile install attribution and marketing measurement. Receives basic device information (a device identifier, phone model, iOS version, and IP address, from which it infers a country or region) and a small set of app-usage events — completing onboarding or the tutorial, signing in, and finishing an Unplug session — so we can see which campaigns bring people who actually use MOQA. Never receives your username, email address, birth date, or Apple's advertising identifier, and never receives your MQ Score, your Bank It submissions, your Spin challenge results, or your Screen Time or health data.

• Tremendous — our Reward issuance provider. When you redeem a Bag for a digital gift card or charity donation through Get the Bag, we share the Reward participant's email address (a parent or guardian's for users under 18), the Reward's value and currency, and the brand you chose with Tremendous so it can issue and deliver it. That is the whole list. Tremendous learns that a Reward of that value is to be issued, and nothing about how you earned it — never your name, username, MQ Score, your Bank It submissions, your Spin challenge results, your Circles data, or any Screen Time- or health-derived information. If you redeem for merchandise, we share the shipping details needed to fulfill your order with our fulfillment provider. Once a third-party Reward is delivered, it's governed by the issuer's terms, and the issuer handles the information it needs for its own legal, security, and fraud-prevention obligations under those terms.

• Firebase Crashlytics (Google) — crash reporting. Receives crash logs and diagnostic data (device model, OS version, app version, and an anonymous installation identifier) so we can find and fix bugs. We use no other Firebase or Google Analytics products, and nothing sent to Crashlytics includes your MQ Score, Bank It data, or health-derived information.

• OneSignal — push notifications. Receives a push subscription identifier and the text of each notification so it can deliver the notifications you've enabled. Notification text can include your Circle's name, another member's username, your Buddy avatar, and occasionally a number from your own stats. OneSignal never receives your email address, username, or birth date, and never receives your Bank It submissions or health data.

• Brevo — email delivery and contact management. Holds your email address (or Apple relay address), your username, and — if you signed in with Apple and shared it — your first and last name and Apple user ID; receives the one-time codes we send for sign-in and the parent or guardian email addresses we use for under-16 consent and notices; and delivers internal usage reports to our team that include usernames, age groups, and MQ Scores (never email addresses or real names). Being in our Brevo contact list does not put you on marketing emails — those go only to people who opt in.

Your Circles. When you join a Circle, other members of that Circle see the MOQA-level information described in the App and our Terms of Use — such as your username, your Buddy, your MQ Score, and your competition standings. This is information you choose to share by joining, it applies to members of any age (see Section 9), and you can leave a Circle at any time. Circle members never see your underlying Screen Time data or your Bank It submissions.

Professional advisors. Lawyers, accountants, and similar advisors where necessary for the services they provide to us.

Legal and protective disclosures. Where required by law, subpoena, or legal process, or where reasonably necessary to protect the rights, safety, or property of you, us, or others, or to enforce our Terms of Use.

Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of the transaction, subject to this Policy's commitments or successor commitments no less protective; we will notify you of material changes.

Apple. Your use of MOQA on Apple devices involves Apple as described in its own terms and privacy policy — for example, Apple processes your subscription payments and operates the Screen Time framework on your device.

One commitment worth repeating: your Bank It data — your derived MQ Score components and validations — and your HealthKit data are never provided to AppsFlyer, Crashlytics, OneSignal, Tremendous, or any advertising, analytics, attribution, crash-reporting, notification, or rewards partner (not as data fields, not as event names, not in logs), are never used for marketing or advertising, and are never sold. They are processed only to run MOQA, on infrastructure acting on our behalf.

​

6. Cookies & Our Website

Our website at www.moqa.me runs on a website platform (currently Wix) and uses cookies and similar technologies that are necessary for the site to function, plus the platform's built-in visitor analytics to understand site traffic (pages visited, approximate location from IP address, and device and browser type). We do not use cookies to build advertising profiles of you or to track you across other companies' websites, and we do not run advertising pixels on the site. Where your region requires it, we ask for your consent before setting non-essential cookies. Your browser settings let you block or delete cookies; the site may not work fully without essential ones.

​

7. How Long We Keep Information

We keep personal information only as long as we need it for the purposes described in this Policy — such as maintaining your account, persisting your MQ history, and verifying Beans, Bags, and Rewards — and as required for legal, accounting, or fraud-prevention purposes. Your MQ history persists while your account exists: if you stop using Bank It or revoke a device permission, no new summaries are added, but the ones you already submitted remain until you delete your account or ask us to delete them. When you delete your account, we delete or de-identify your personal information within 90 days, except where we are legally required to keep it or need it to resolve disputes or enforce our agreements. Residual copies may persist in encrypted backups for a limited period before being cycled out. That 90-day window is our outer limit for completing account deletion; it is not how long we take to respond to a privacy request, which we handle within the time your local law requires.

​

8. How We Keep Information Secure

We treat your data — especially your Bank It submissions and any health-derived data — as sensitive, and we protect it with technical, organizational, and physical safeguards: encryption in transit and at rest, encrypted QR encoding for Bank It, access controls, and the principle of collecting the minimum necessary. No method of transmission or storage is 100% secure, so we can't guarantee absolute security, but the less we collect, the less there is to lose — and that's by design. If we learn of a security incident affecting your personal information, we will notify you and any regulator as applicable law requires. If you believe your account has been compromised, contact us immediately at support@moqa.me.

​

9. Children

MOQA is for people 13 and older (or older where your region sets a higher minimum age). For users under 16, a parent or legal guardian must approve the account before it activates: we collect a parent's email address for the sole purpose of seeking that consent, the parent provides a code to the user, and the user enters the code in the app to unlock access. We take reasonable measures, in light of available technology and how we use the information, to verify that the person providing consent is a parent or legal guardian, and we may request additional information where needed to do so. Because we use a minor's personal information only to operate the Service and never disclose it to third parties for their own purposes, we use this email-based consent process as permitted by applicable law, and personal information collected from minors is processed only by service providers acting on our behalf under contractual confidentiality and security obligations (see Section 5) — the one exception is the MOQA-level information (username, Buddy, MQ Score, standings) a minor chooses to show other members by joining a Circle, described under "Your Circles" in Section 5. Before the age screen, a few of our providers register the device as described in Section 3.4; that registration never includes a name, email address, or birth date. We use the parent's email address only for the consent process and legally required notices, and if consent is not completed within 30 days, we delete the parent's email address, the registration information provided, and any other personal information collected during signup. If a user under 18 redeems a Reward, the parent or guardian is the Reward participant under our Terms of Use, and we use the parent's email address to deliver it (see Section 3.1). A parent or guardian may contact us at support@moqa.me at any time to review their child's information, revoke consent, or delete the account. Where an account belongs to a minor under 18, a parent or legal guardian is responsible for the account under our Terms of Use. We do not knowingly collect personal information from children under 13, consistent with the U.S. Children's Online Privacy Protection Act (COPPA) and similar laws elsewhere, and if we learn we have collected personal information from a child under 13 (or under the applicable regional minimum) without required consent, we will delete it. If you believe a child under 13 has created an account or provided personal information through MOQA, contact us at support@moqa.me.

​

10. Your Choices

• Device permissions. Screen Time (Device Activity), HealthKit, and notification permissions are granted through Apple's system prompts and can be revoked anytime in your device settings. Screen Time authorization is required for MOQA's core features to work; HealthKit and notifications are optional. Revoking a permission stops MOQA from reading new data; it doesn't delete the derived summaries you've already submitted through Bank It — use "Delete your data" for that.

• Bank It is always your choice. You can use MOQA without ever submitting Bank It data — you'll still see your MQ Score and daily statistics for the current day, though your information won't persist beyond that day and rewards that depend on verified activity won't be available.

• Circles. Joining a Circle is optional, and you can leave one at any time; once you leave, its members no longer see your MQ Score or standings.

• Marketing. Unsubscribe from marketing emails anytime via the footer link or by emailing support@moqa.me. Service and account messages continue while you have an account.

• Delete your data. You can delete your account and data from inside the app's settings, or by contacting us at support@moqa.me. We complete deletion as described in Section 7.

• Access and correction. You can update your account information in the app, and you can contact us to access, correct, or obtain a copy of your personal information.

11. United States State Privacy Rights

Depending on your state (including California, Colorado, Connecticut, Texas, Virginia, and others with comprehensive privacy laws), you may have rights to: know and access the personal information we've collected about you; correct inaccurate information; delete your information; obtain a portable copy; opt out of sales, sharing for targeted advertising, and certain profiling; and not be discriminated against for exercising your rights. We honor these rights as described in Section 10 and this Section, and you can exercise them in the app or by emailing support@moqa.me. If we decline a request, you may appeal by replying to our response, and we'll review it.

11.1 California (CCPA/CPRA)

In the last 12 months, we have collected these categories of personal information: identifiers (such as email, username, Apple user ID, device identifiers, IP address); customer records information (including a name, if you share one through Sign in with Apple); characteristics of protected classifications (birth month and year, used for our age requirements); commercial information (subscription plan and purchase history); internet or other electronic network activity (your MOQA app usage, your onboarding estimates, and the Screen Time-derived MQ Score components you submit through Bank It); coarse geolocation (country or region inferred from IP by our attribution provider); sensitive personal information (health-derived components you choose to submit through Bank It, computed with your permission from HealthKit data); and inferences (such as your MQ Score and MOQA Level, used to provide the Service). The sources, purposes, and disclosures for each are described in Sections 3–5, and we keep each category for the periods and criteria described in Section 7.

We do not sell personal information and have not done so in the preceding 12 months; we do not share personal information for cross-context behavioral advertising; and we have no actual knowledge of selling or sharing the personal information of consumers under 16. We use and disclose sensitive personal information only for the purposes permitted by the CCPA — providing the Service you've requested, security, and quality assurance — so the right to limit use of sensitive personal information does not require a separate link. Because we do not sell or share personal information, opt-out preference signals like Global Privacy Control do not change how we treat your data, but we honor them as the law requires. California's "Shine the Light" law: we do not disclose personal information to third parties for their direct marketing purposes.

You may exercise your rights through an authorized agent; we'll require proof of authorization and may verify your identity directly. We will verify requests using information associated with your account and will not discriminate against you for exercising your rights.

​

12. Other Regions

Wherever you live, the commitments in this Policy apply to you, and we honor the choices and rights described in Section 10 for everyone: you can access, correct, and delete your personal information, obtain a copy of it, and withdraw permissions and consents at any time. Where your local law gives you additional rights, we honor them as it requires. Your personal information is stored and processed primarily in the United States, as described in Section 13. If you have a privacy question, concern, or complaint, contact us first at support@moqa.me — most issues can be resolved directly, and we respond to every request. You also have the right to lodge a complaint with the privacy regulator in your country.

​

13. International Transfers

We are based in the United States, and your information is processed primarily in the United States; some of our service providers may process it in other countries under contractual safeguards. Privacy laws there may differ from those in your country. Wherever your information is processed, we apply the protections described in this Policy and any safeguards required by applicable law.

​

14. Changes to This Policy

We may update this Policy from time to time. The "Last Updated" date shows the current version. For material changes, we'll notify you by email or in-app before they take effect, and where the law requires your consent to a change, we'll ask for it. If you keep using the Service after an update takes effect, the updated Policy applies to your use.

​

15. Contact Us

Questions, requests, or complaints: support@moqa.me, or by mail to BOMAD LLC, 1107 Fair Oaks Avenue, #226, South Pasadena, CA 91030, or by telephone at (213) 421-1210. If we haven't explained something clearly enough, tell us — plain language is the point.

Your attention is yours. So is your data. MOQA exists to protect both.